Last Comment Bug 657201 - (CVE-2011-2368) WebGL crash [@createProgram/@gldCopyTexSubImage]
(CVE-2011-2368)
: WebGL crash [@createProgram/@gldCopyTexSubImage]
Status: RESOLVED FIXED
[sg:critical?]
:
Product: Core
Classification: Components
Component: Canvas: WebGL (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: mozilla6
Assigned To: Benoit Jacob [:bjacob] (mostly away)
:
: Milan Sreckovic [:milan]
Mentors:
Depends on:
Blocks: 658170
  Show dependency treegraph
 
Reported: 2011-05-15 01:42 PDT by Christoph Diehl [:posidron]
Modified: 2016-07-05 02:17 PDT (History)
8 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
+
fixed
wanted
unaffected
unaffected


Attachments
testcase (16.15 KB, application/zip)
2011-05-15 01:42 PDT, Christoph Diehl [:posidron]
no flags Details
callstack1-read-0 (17.10 KB, text/plain)
2011-05-15 01:44 PDT, Christoph Diehl [:posidron]
no flags Details
callstack2-write-0 (16.13 KB, text/plain)
2011-05-15 01:44 PDT, Christoph Diehl [:posidron]
no flags Details
callstack3-write-value.txt (17.10 KB, text/plain)
2011-05-15 01:45 PDT, Christoph Diehl [:posidron]
no flags Details
really disable validateProgram() on Mac (1.02 KB, patch)
2011-05-16 08:02 PDT, Benoit Jacob [:bjacob] (mostly away)
cdiehl: review+
asa: approval‑mozilla‑beta+
Details | Diff | Splinter Review

Description Christoph Diehl [:posidron] 2011-05-15 01:42:57 PDT
Created attachment 532499 [details]
testcase

Sometimes it crashes in createProgram, sometimes in gldCopyTexSubImage.

The bug is currently only reproducible against:

ProductName:	Mac OS X
ProductVersion:	10.6.7
BuildVersion:	10J869
OpenGL renderer string: ATI Radeon HD 6750M OpenGL Engine
OpenGL version string: 2.1 ATI-1.6.32

I have marked this as a security issue because I get some write violations at different places.
Comment 1 Christoph Diehl [:posidron] 2011-05-15 01:44:01 PDT
Created attachment 532500 [details]
callstack1-read-0
Comment 2 Christoph Diehl [:posidron] 2011-05-15 01:44:25 PDT
Created attachment 532501 [details]
callstack2-write-0
Comment 3 Christoph Diehl [:posidron] 2011-05-15 01:45:15 PDT
Created attachment 532502 [details]
callstack3-write-value.txt
Comment 4 Benoit Jacob [:bjacob] (mostly away) 2011-05-16 07:56:39 PDT
Oh oh, really interesting! All 3 crashes have in common to be happening inside of glValidateProgram(). In bug 593867, we already decided to avoid calling glValidateProgram on Macs with NVIDIA cards. Now you're getting problems with a ATI card --> let's completely avoid glValidateProgram() which means that it wasn't NVIDIA specific.
Comment 5 Benoit Jacob [:bjacob] (mostly away) 2011-05-16 07:58:19 PDT
Chris, I had filed Apple bug 9129482, but it got closed as "missing information". It seems that this bug could use some pushing by an Apple insider ;-)
Comment 6 Benoit Jacob [:bjacob] (mostly away) 2011-05-16 08:02:07 PDT
Created attachment 532643 [details] [diff] [review]
really disable validateProgram() on Mac
Comment 7 Benoit Jacob [:bjacob] (mostly away) 2011-05-16 08:02:58 PDT
Note: it's also very interesting to have this on Mac OS 10.6.7. My Apple bug got closed as I was unable to confirm whether it still happened on 10.6.7.
Comment 8 Christoph Diehl [:posidron] 2011-05-16 08:31:59 PDT
Fixed - thanks Benoit.
Comment 9 Benoit Jacob [:bjacob] (mostly away) 2011-05-16 08:52:32 PDT
We should keep this bug open until it's actually fixed in the tree! Please review my patch or tell me if you would like me to find someone else.
Comment 10 Christoph Diehl [:posidron] 2011-05-16 08:58:29 PDT
Oh. Sorry for closing it to early.

I already reviewed your patch, applied it to my build and checked it against the provided testcase. ;)
Comment 11 Benoit Jacob [:bjacob] (mostly away) 2011-05-16 09:01:51 PDT
Welcome to Mozilla bureaucracy: if you approve my patch, please click 'Details', then on the 'review' line, select '+'.

Then we will land it, paste here a link to the changeset, and finally close this bug.
Comment 12 Asa Dotzler [:asa] 2011-05-19 15:16:46 PDT
Comment on attachment 532643 [details] [diff] [review]
really disable validateProgram() on Mac

Please land this change on both Aurora and Beta. (In the future, getting changes in during Aurora will save you this extra step.)
Comment 13 Benoit Jacob [:bjacob] (mostly away) 2011-05-20 18:01:35 PDT
mozilla-central:
http://hg.mozilla.org/mozilla-central/rev/9ca849387799

I didn't realize that this was now sg-critical, sorry. Will land on aurora and beta ASAP.
Comment 14 Benoit Jacob [:bjacob] (mostly away) 2011-05-26 11:41:15 PDT
Pushed to Beta:
http://hg.mozilla.org/releases/mozilla-beta/rev/eba2dce26189

The fix was already on Aurora, as the Central->Aurora merge happened since I landed on Central.
Comment 15 Jukka Jylänki 2016-07-05 02:17:44 PDT
The workaround that was added in this issue is about 5 years old now. Marked down bug 1284425 to discuss if the workaround is relevant any more on recent OS X versions.

Note You need to log in before you can comment on or make changes to this bug.